Castilla listed on Nova ransomware leak site following alleged data breach

• Ransomware group: Nova
• Country: Spain
• Sector: Retail & E-Commerce
• Announcement date: November 2, 2025

Nova claims to have compromised Castilla

The threat actor known as Nova has listed Castilla on its leak site, alleging a data breach. This announcement, which appeared on November 2, 2025, indicates that the group claims to have successfully compromised data belonging to the organization.

The Nova group has published the company on its dedicated leak platform, asserting that they have gained unauthorized access to the organization's systems. This type of activity is a hallmark of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information on public leak sites to pressure the victim into paying a ransom.

The announcement specifically identifies the victim as operating within the consumer services sector. While the group has made this claim public, the incident remains an allegation until further verification is established. Ransomware leak sites serve as a public stage for these groups to exert pressure, often providing a sense of transparency to the victim's stakeholders while simultaneously damaging the victim's reputation.

Details regarding the alleged leaked data

Despite the claims made by the Nova group, there is a significant lack of specific information regarding the contents of the alleged breach. At this stage, no specific details or sample files regarding the content of the alleged leaked data have been provided by the threat actor.

• The listing names no specific data types.

>

The absence of information regarding the volume of data, the specific files involved, or the exact nature of the compromised information is notable. In many ransomware incidents, attackers may eventually release samples of data to prove the validity of their claims, but no such evidence has been made available in this instance.

About Castilla

Castilla is a consumer services company based in Soria, Spain. It operates as a small-scale business within the retail and e-commerce landscape.

Potential impact and organizational implications

This incident may pose risks to Castilla's operational continuity and corporate reputation. Because the organization operates in Spain, the confirmation of a breach could lead to legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). Such regulatory frameworks are designed to ensure that organizations maintain high standards of data protection and hold them accountable when breaches occur.

If customer or employee data has been compromised, it may increase the likelihood of affected individuals being targeted by identity theft or spear-phishing attacks. These secondary attacks often follow a primary breach, as stolen information provides a foundation for more convincing social engineering attempts.

Information regarding the Nova group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their future behavior. For organizations facing similar threats, several defensive steps are commonly recommended to mitigate risks. These include maintaining robust data security protocols, implementing multi-factor authentication, and ensuring regular, offline backups of critical information. Furthermore, organizations may need to review their data security protocols and notify the affected parties to maintain transparency and comply with legal obligations.